The EU’s cybersecurity team, CERT-EU, has identified TeamPCP as the group responsible for hacking the European Commission’s cloud. They stated that this attack compromised the information of at least 29 other EU organizations.

The European Commission made the incident public on March 27 after BleepingComputer inquired about the breach of the European Union’s executive branch’s cloud environment on Amazon.

Two days prior to that, the Commission alerted CERT-EU about the hack, noting that its Cybersecurity Operations Center didn’t detect any improper API usage, potential compromised accounts, or strange network behavior until March 24, which was five days after the initial unauthorized access.

On March 10, TeamPCP used a stolen Amazon Web Services API key with administrative privileges for other European Commission AWS accounts (obtained from the Trivy supply-chain attack) to infiltrate the Commission’s cloud environment on Amazon.

In the following phase of the attack, they deployed TruffleHog (a tool used for finding and confirming cloud credentials) to identify additional sensitive information. Then, they connected a newly created access key to an existing user account to avoid detection before performing further analysis and stealing data.

TeamPCP has been connected to software supply chain attacks that target multiple developer platforms, including GitHub, PyPi, NPM, and Docker.

This cybercriminal group also compromised the LiteLLM PyPI package, which impacted tens of thousands of devices through the use of their “TeamPCP Cloud Stealer” malware.

On March 28, ShinyHunters, a data extortion group, released the stolen information on their dark web leak site as a 90GB archive of documents (roughly 340GB uncompressed), which contained names, email addresses, and email content.

CERT-EU’s investigation verified that the attackers stole tens of thousands of files that included personal information, usernames, email addresses, and email content. The resulting breach reportedly affected 42 internal European Commission clients and at least 29 other EU bodies that use the europa.eu web hosting service.

“The compromised AWS secret was used by the attacker to extract data from the impacted cloud environment. This data is related to websites hosted for a total of 71 Europa web hosting service clients, including 42 internal European Commission clients and at least 29 other EU entities,” CERT-EU stated on Thursday.

It further added that, “Analysis of the published data has so far confirmed the presence of personal data, including lists of first names, last names, usernames, and email addresses. While this is primarily from the European Commission’s websites, it potentially pertains to users across multiple EU entities.”

“The information also includes a minimum of 51,992 files related to outgoing email messages, totaling 2.22 GB. While the majority consists of automated notifications with minimal content, ‘bounce-back’ notifications, which are responses to incoming messages from users, might contain the original user-submitted content, creating a personal data exposure risk.”

CERT-EU also noted that no websites were taken offline or altered because of the incident, and there was no sign of unauthorized access to other Commission AWS accounts.

The analysis of the stolen databases and files is ongoing and is expected to require “a significant amount of time.” The Commission has informed the relevant data protection authorities and is in direct communication with the entities that were potentially affected.

In February, the European Commission revealed another data breach after discovering a hack of a mobile device management platform used to manage staff devices.